1

I have a managed package that includes a connected app. After installation Subscribers add users to a permission set to access the connected app. When the users object the canvas app within the package they get authenticated into an external web application.

Part of that authentication process passes over a valid Salesforce SessionId and serverURL for use with the Partner API. As long as the users Profile has "API Access" this has been working well.

One subscriber has been reporting that users with a couple of profiles are unable to access the connected app. It starts to load, and then fails when attempting to call the Partner API.

The logging shows the response from the Partner API to a getUserInfo() as being:

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:sf="urn:fault.partner.soap.sforce.com" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <soapenv:Body>
      <soapenv:Fault>
         <faultcode>sf:INSUFFICIENT_ACCESS</faultcode>
         <faultstring>INSUFFICIENT_ACCESS: null</faultstring>
         <detail>
            <sf:UnexpectedErrorFault xsi:type="sf:UnexpectedErrorFault">
               <sf:exceptionCode>INSUFFICIENT_ACCESS</sf:exceptionCode>
               <sf:exceptionMessage/>
            </sf:UnexpectedErrorFault>
         </detail>
      </soapenv:Fault>
   </soapenv:Body>
</soapenv:Envelope>

Temporarily moving the affected users to other profiles avoids the issue and the API calls can be made successfully.

The problem profile definitely has "API Access" enabled.

What could be preventing users with certain profiles from accessing the API even though they have access?

1

In this specific case it turned out the problem profiles had "IP Restrict Requests" enabled and our external web servers IP wasn't listed as trusted.

What is odd is that the docs say the "IP Restrict Requests" setting:

Allows the portal user to only login from a limit of 5 IPs addresses.

These are neither portal users nor are they logging in. So it isn't immediately clear why it is coming into play.

The permission set UI shows it with the description:

Restrict what IP addresses can access in the PRM Portal.

enter image description here

Again, the managed connected app has nothing to do with Partner Relationship Management, but the IP restrictions still seem to apply.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.